1. Field
The present invention relates, in general, to conditional access to diagnostic functions in a hardware device.
2. Description of the Related Art
A typical digital or cable television system includes a hardware device, such as a set-top box, that connects a subscriber's television, and possibly other electronic equipment, to a cable network. The hardware device typically connects to the cable network via a co-axial wall outlet.
A prior art solution to secure debugging is to have a separate hardware configuration for test/prototype devices. For example, a test device either can accept unsigned/unverified code, or can require code to be signed with a separate test key. On the other hand, a production device with a production hardware configuration only accepts code signed with a production-signing key. This prior art method would thus prevent insecure debugging code from running in production devices that can be sold to a consumer and require a higher level of security.
These prior art solutions do not solve all of the debugging needs, however. For example, a production box already sold to a consumer could malfunction and is then returned back to the manufacturer for investigation. In this case, there is a clear need to perform debugging functions on a production box and not on a test box.
Furthermore, some functions are simply not available in test boxes. For example, some cable set-top boxes will not output video unless they have a CableCARD removable PCMCIA module plugged in. Also, only production boxes containing the necessary secret keys are able to communicate with a CableCARD. Thus, if an engineer needs to debug a problem related to the CableCARD interface, there is no choice but to perform debugging in a production device.
Other related prior art makes use of digital certificates to verify a signed code image that is accepted by a particular device. In some cases, a digital certificate contains a device identifier attribute that is unique to one specific device. This digital certificate would be issued to a developer thus enabling him to sign code that will run only on one device. This could be test code with insecure/debugging functions. A digital certificate binds this code to one particular prototype device; this code cannot run anywhere else and so cannot be used to compromise production devices.
Such a digital certificate bound to one device, however, is difficult to expire and has limited flexibility. Normally, such device-bound digital certificates do not include an expiration time attribute since most consumer devices do not have a reliable and secure source of time. Also, there is no other mechanism to make such a digital certificate expired or invalid. Within the related art, either this bound digital certificate unlocks all possible debugging functions or it unlocks a very limited set of debugging functions enforced by a hardware platform. It is not possible to easily add control of new debugging capabilities as they become available.
Furthermore, this method has a disadvantage that debugging permissions are tied to a signed code image (in a form of a digital certificate). In order to change debugging permissions, it becomes necessary to reload a different code image signed with a different certificate. It is often more convenient to control debugging privileges independent of which code is running in a particular device. If a returned unit comes from the field and requires debugging, it may be necessary to reproduce the problem with the exact same software image already in the device and thus there is a need to control debugging capabilities without touching the software already in the device.
In the case of unlocking diagnostic features, including debugging features, additional security mechanisms are necessary to account for the expiration of those features and, in addition, the system cannot rely on continuous connectivity from the set-top box to a head-end. Even though a hardware device, such as a set-top box, may not be on-line or may have some code bugs that do not allow it to get on-line, there is still a need to securely enable and disable diagnostic and debugging features to resolve a problem with the hardware device.
Furthermore, the act of unlocking the diagnostic and debugging features in a hardware device makes an unlocked device unsuitable for production and a security risk, regardless of how the hardware device was unlocked. Therefore, an audit trail is needed to keep track of which users unlocked which devices, and to make sure that such devices do not make it into the field and also to find those users that violated security policy and misused debugging features to reverse engineer a device, steal secret keys, etc.
Thus, there is a demand for a system and method for unlocking diagnostic functions in a hardware device for a user. Aspects of the presently disclosed invention are able to satisfy this demand.